Audit logs only matter at two moments: when an auditor asks for them, and when something has gone wrong. Both moments arrive without warning, and both go badly if the logs are scattered across the machines involved — including, quite possibly, the machine the attacker had.
This guide covers what to collect, how long to keep it, and which free tools do the collecting.
The free options
| Tool | Role | Needs a server |
|---|---|---|
| Graylog | Central collection, search, streams, dashboards and alerts | Yes |
| EventSentry Light | Windows event log monitoring and alerting on a small number of hosts | No |
| LogExpert | Reading and filtering large log files on the spot | No |
| NetXMS | Syslog and SNMP trap collection alongside monitoring | Yes |
Central collection: Graylog
Graylog is the free tool that does the real job. It accepts syslog and Windows events, indexes them, and gives you search, saved streams, dashboards and alerting. Crucially, it puts the logs somewhere other than the machine that generated them — which is the entire point of an audit log.
It wants a dedicated server and its storage back end, and the initial setup is a day’s work rather than an hour’s. Budget the time once; the alternative is logging in to eleven machines during an incident.
When you cannot run a server: EventSentry Light
EventSentry Light watches Windows event logs on the machine it runs on, applies rules and sends alerts. The free edition limits how many hosts you can cover, so use it where it counts: domain controllers, file servers, anything holding data you would have to report on.
It answers “tell me when this happens” rather than “let me search six months of history”, but that first question is often the urgent one.
Reading what you already have: LogExpert
Not every investigation justifies a platform. LogExpert opens large log files quickly, tails them live, applies filters and highlights patterns, with bookmarks and multiple files side by side. When someone hands you a 400 MB application log, this is what you open.
Network devices too: NetXMS
Switches, routers, firewalls and appliances send syslog and SNMP traps, and those messages are part of the audit trail. NetXMS collects both alongside its monitoring, so network events and availability data sit in one place. Remember the 250-node limit on the Windows server build.
What is worth collecting
Collecting everything produces a bill and a haystack. Start with the events that answer the questions you will actually be asked:
- Authentication — successes and failures, and specifically failures followed by a success from the same source.
- Privilege changes — group membership, new accounts, rights assignments.
- Access to sensitive data — file access auditing on the shares that matter, not on everything.
- Configuration and policy changes — Group Policy, firewall rules, scheduled tasks, services.
- Remote access sessions — who connected to what, from where, for how long.
- Security tooling — antivirus detections, firewall blocks, backup job results.
- Log service health — if collection stops, that is itself an event.
Retention that stands up
Pick a period and be able to show that you keep to it. Common practice is 90 days searchable and a year or more in cheaper archive storage, but your regulator, contracts or insurer may set the number. Whatever it is, write it down, configure it, and check once a quarter that the oldest record is where the policy says it should be.
Integrity: the part auditors ask about
An audit log the administrator can edit is a document, not evidence. Practical measures with free tools:
- Ship logs off the source host immediately. This is the single most valuable control and the reason to run Graylog at all.
- Restrict who can delete on the collector. Separate the accounts that administer servers from the accounts that administer the log platform.
- Archive to write-once or append-only storage where you can.
- Alert on gaps. A quiet host is suspicious. Alert on the absence of expected events, not only on their presence.
- Keep the clocks right. Correlating an incident across hosts with drifting clocks is guesswork. NTP everywhere.
A realistic free setup
- Graylog on a dedicated server, with syslog and a Windows log shipper feeding it.
- NetXMS collecting syslog and traps from network gear and forwarding the important ones.
- EventSentry Light on the two or three Windows servers that need immediate alerting.
- LogExpert on the admin workstation for ad-hoc file analysis.
- Backup job reports and remote access session logs shipped to the same collector.
That covers collection, alerting, search and separation of evidence from source, at no licence cost. What it does not cover is threat detection content — the correlation rules and intelligence feeds a commercial SIEM brings. You will be writing your own rules, and they will only be as good as the time you spend on them.
FAQ
What is the best free log management tool?
Graylog, if you can run a server. It gives you central collection, search and alerting without a licence.
How long should audit logs be kept?
90 days searchable and a year or more archived is a common baseline, but contracts and regulators often set a specific figure — check before choosing.
Can I collect logs without a dedicated server?
Partly. EventSentry Light monitors and alerts locally, but without central collection the logs stay on the host that produced them.
What should I monitor first?
Authentication failures, privilege and group changes, and the health of log collection itself.
How do I stop logs being tampered with?
Ship them off the source machine as they are written and restrict deletion on the collector to a separate set of accounts.
